Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

Envista Holdings Corporation•Irvine, CA

1d•$182,900 - $223,600•Onsite

About The Position

We are seeking a strategic and hands-on Security Operations and Engineering Lead to serve as Envista’s senior technical expert for security operations, detection engineering, incident response, and security platform capabilities. Operating with a high degree of autonomy, this role translates the Global Head of Information Security & GRC’s direction into scalable capabilities, operating models, roadmaps, and measurable outcomes. This leader provides domain leadership for the SOC, incident response program, detection lifecycle, and security tooling ecosystem and is responsible for building scalable, threat-informed, and measurable security operations. The role shapes direction within the Security Operations & Engineering domain, recommends priorities and investments, and influences enterprise decisions through technical expertise, while final accountability for Envista’s overall cybersecurity strategy remains with the Global Head of Information Security & GRC.

Requirements

Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering, or a related field
Equivalent industry experience, military service, professional certifications, and demonstrated leadership experience are valued equally
10+ years of progressive cybersecurity experience, including substantial depth in security operations, detection engineering, incident response, or security engineering
7+ years leading complex security operations, engineering, SOC, or incident response capabilities, teams, or enterprise programs
Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.
Experience managing MSSP, MDR, SOC-as-a-Service, or strategic security service providers.
Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle, etc.)
Experience in Azure, AWS, or GCP environments.
Demonstrated experience developing enterprise security strategy, capability roadmaps, architecture, standards, and operating models within an assigned domain.
Demonstrated ability to solve novel, ambiguous, and highly complex security problems with broad enterprise impact.
Understanding of Zero Trust security principles and modern detection strategies.
Demonstrated ability to advise executive leadership, influence enterprise decisions, and translate complex technical risks into business implications, strategic options, and investment recommendations.
Experience leading highly complex investigations and incident response across security, IT, Legal, Privacy, HR, Communications, and executive stakeholders in situations with significant operational, regulatory, financial, or reputational implications.

Nice To Haves

Experience defining and executing multiyear security capability roadmaps, target-state architectures, and operating models.
Experience building or transforming an enterprise SOC and security engineering capability in a global or multi-business environment.
Experience supporting a global or multi-business-unit environment.
Experience leading incident response for major cybersecurity events
CISSP; CISM; CCSP
GIAC certifications (GCIH, GCIA, GCFA, GMON)
Microsoft Security certifications
Splunk certifications
Microsoft Sentinel certifications
CrowdStrike certifications
AWS/Azure/GCP security certifications

Responsibilities

Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.
Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes.
Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and the cybersecurity strategy established by the Global Head of Information Security & GRC.
Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness.
Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap for approval by the Global Head of Information Security & GRC.
Develop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms.
Drive automation across triage, enrichment, containment, and reporting workflows.
Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities across the enterprise.
Define enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standards.
Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement based on enterprise risk, business value, and alignment with cybersecurity priorities.
Provide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications, within the governance and escalation framework established by the Global Head of Information Security & GRC.
Serve as the senior operational and technical lead for major incidents, directing containment, eradication, recovery, and root cause analysis and advising executive leadership on response options and business implications.
Ensure post-incident reviews drive durable control improvements.
Develop response strategies for novel or unprecedented cybersecurity events where established playbooks are insufficient.
Coordinate with Legal, Privacy, HR, IT, and Communications.
Build detection engineering lifecycle: hypothesis → development → testing → tuning → deployment → validation → retirement.
Develop behavior-based and threat-informed detections aligned to MITRE ATT&CK.
Expand monitoring across endpoint, identity, cloud, SaaS, network, and critical applications.
Anticipate emerging detection gaps and develop innovative, threat-informed solutions using red team, penetration testing, vulnerability, incident, and external threat intelligence.
Shape and advance exposure management, asset inventory visibility, and attack surface monitoring capabilities across the enterprise.
Drive continuous control monitoring and validation of key security controls.
Improve vulnerability remediation workflows and risk reduction outcomes.
Drive measurable improvements in enterprise cyber resilience, operational continuity, and material-risk reduction across business units and technology environments.
Build and lead high-performing security operations and engineering teams and strategic partners, while serving as the senior technical leader for the domain.
Design and implement the Security Operations & Engineering operating model, defining roles, decision rights, governance, and accountability across internal teams and service partners.
Advise executive leadership on threats, incidents, control gaps, maturity, strategic tradeoffs, and recommended investments, translating complex technical issues into clear business implications.
Influence GRC, Audit, IT, Architecture, and business leaders to align on enterprise standards, resolve complex cross-functional risks, and advance cybersecurity priorities without relying solely on direct authority.